(ITS#7176) slapindex -q -t segfaults with back-mdb

[quanah@OpenLDAP.org]

Full_Name: Quanah Gibson-Mount
Version: 2.4.29 + ITS7174
OS: Linux 2.6
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (75.108.184.39)


When running slapindex -q -t, back-mdb segfaults:
Thread 1 (Thread 0x7ffff7fef700 (LWP 20316)):
#0  0x00007ffff34a1b45 in mdb_midl_append (idp=0x8f1fa8, id=6) at
../../../libraries/libmdb/midl.c:148
        ids = 0x0
#1  0x00007ffff34a1712 in mdb_drop0 (mc=0x8dcd80, subs=4) at
../../../libraries/libmdb/mdb.c:5990
        ni = 0x7febf2556eb4
        mx = {mc_next = 0x1104184c, mc_orig = 0x7ffff7de7722, mc_xcursor = 0x0,
mc_txn = 0x8f1f80, mc_dbi = 5, mc_db = 0x8f20d8, mc_dbx = 0x8d8070, mc_dbflag =
0x80e4e0 "", mc_snum = 1, mc_top = 0, mc_flags = 16, 
          mc_pg = {0x7febf2556000, 0x7fffffffe5f0, 0x0, 0x80e838,
0x7fffffffe3c0, 0x7fffffffe3d8, 0x100000000, 0x893590, 0x7ffff346d4e1,
0x7fffffffe5f0, 0x38, 0x3a0, 0x38, 0x7fffffffe5f0, 0x8afa90, 0x0, 
            0x7ffff6314e40, 0x7fffffffe480, 0x378, 0x7fffffffea50, 0x0, 0x0,
0x8dcd80, 0xa25d2c9e, 0x8dcf08, 0x7fffffffe420, 0x7ffff349d1c0, 0x8dcf08,
0x5ffffe690, 0x8f1f80, 0x8dcd80, 0x7fffffffe480}, mc_ki = {
            507, 62281, 32767, 0, 58496, 65535, 32767, 0, 58528, 65535, 32767,
0, 0, 0, 5, 0, 8064, 143, 0, 0, 59376, 65535, 32767, 0, 888, 0, 0, 0, 53000,
141, 0, 0}}
        i = 20
        rc = 0
#2  0x00007ffff34a1796 in mdb_drop (txn=0x8f1f80, dbi=5, del=0) at
../../../libraries/libmdb/mdb.c:6008
        mc = 0x8dcd80
        rc = 0
#3  0x00007ffff34753e8 in mdb_tool_entry_reindex (be=0x8afa90, id=0, adv=0x0) at
tools.c:770
        i = 0
        mi = 0x7ffff2751010
        rc = 0
        e = 0x0
        op = {o_hdr = 0x0, o_tag = 0, o_time = 0, o_tincr = 0, o_bd = 0x0,
o_req_dn = {bv_len = 0, bv_val = 0x0}, o_req_ndn = {bv_len = 0, bv_val = 0x0},
o_request = {oq_add = {rs_modlist = 0x0, rs_e = 0x0}, 
            oq_bind = {rb_method = 0, rb_cred = {bv_len = 0, bv_val = 0x0},
rb_edn = {bv_len = 0, bv_val = 0x0}, rb_ssf = 0, rb_mech = {bv_len = 0, bv_val =
0x0}}, oq_compare = {rs_ava = 0x0}, oq_modify = {
              rs_mods = {rs_modlist = 0x0, rs_no_opattrs = 0 '\000'},
rs_increment = 0}, oq_modrdn = {rs_mods = {rs_modlist = 0x0, rs_no_opattrs = 0
'\000'}, rs_deleteoldrdn = 0, rs_newrdn = {bv_len = 0, 
                bv_val = 0x0}, rs_nnewrdn = {bv_len = 0, bv_val = 0x0},
rs_newSup = 0x0, rs_nnewSup = 0x0}, oq_search = {rs_scope = 0, rs_deref = 0,
rs_slimit = 0, rs_tlimit = 0, rs_limit = 0x0, rs_attrsonly = 0, 
              rs_attrs = 0x0, rs_filter = 0x0, rs_filterstr = {bv_len = 0,
bv_val = 0x0}}, oq_abandon = {rs_msgid = 0}, oq_cancel = {rs_msgid = 0},
oq_extended = {rs_reqoid = {bv_len = 0, bv_val = 0x0}, 
              rs_flags = 0, rs_reqdata = 0x0}, oq_pwdexop = {rs_extended =
{rs_reqoid = {bv_len = 0, bv_val = 0x0}, rs_flags = 0, rs_reqdata = 0x0}, rs_old
= {bv_len = 0, bv_val = 0x0}, rs_new = {bv_len = 0, 
                bv_val = 0x0}, rs_mods = 0x0, rs_modtail = 0x0}}, o_abandon = 0,
o_cancel = 0, o_groups = 0x0, o_do_not_cache = 0 '\000', o_is_auth_check = 0
'\000', o_dont_replicate = 0 '\000', 
          o_acl_priv = ACL_NONE, o_nocaching = 0 '\000', o_delete_glue_parent =
0 '\000', o_no_schema_check = 0 '\000', o_no_subordinate_glue = 0 '\000',
o_ctrlflag = '\000' <repeats 31 times>, o_controls = 0x0, 
          o_authz = {sai_method = 0, sai_mech = {bv_len = 0, bv_val = 0x0},
sai_dn = {bv_len = 0, bv_val = 0x0}, sai_ndn = {bv_len = 0, bv_val = 0x0},
sai_ssf = 0, sai_transport_ssf = 0, sai_tls_ssf = 0, 
            sai_sasl_ssf = 0}, o_ber = 0x0, o_res_ber = 0x0, o_callback = 0x0,
o_ctrls = 0x0, o_csn = {bv_len = 0, bv_val = 0x0}, o_private = 0x0, o_extra =
{slh_first = 0x0}, o_next = {stqe_next = 0x0}}
        ohdr = {oh_opid = 0, oh_connid = 0, oh_conn = 0x0, oh_msgid = 0,
oh_protocol = 0, oh_tid = 0, oh_threadctx = 0x0, oh_tmpmemctx = 0x0,
oh_tmpmfuncs = 0x0, oh_counters = 0x0, 
          oh_log_prefix = '\000' <repeats 255 times>}
        __PRETTY_FUNCTION__ = "mdb_tool_entry_reindex"
#4  0x00000000004dc624 in slapindex (argc=0, argv=0x7fffffffea58) at
slapindex.c:96
        rtn = 32767
        id = 0
        rc = 0
        progname = 0x51c4c0 "slapindex"
        ad = 0x10
        adv = 0x0
        __PRETTY_FUNCTION__ = "slapindex"
#5  0x0000000000415a20 in main (argc=7, argv=0x7fffffffea58) at main.c:410
        i = 3
        no_detach = 0
        rc = 1
        urls = 0x0
        username = 0x0
        groupname = 0x0
        sandbox = 0x0
        syslogUser = 160
        pid = 0
        waitfds = {3817984, 0}
        g_argc = 7
        g_argv = 0x7fffffffea58
        configfile = 0x0
        configdir = 0x0
        serverName = 0x7fffffffecb8 "slapindex"
        serverMode = 1
        scp = 0x0
        scp_entry = 0x0
        debug_unknowns = 0x0
        syslog_unknowns = 0x0
        serverNamePrefix = 0x4faa68 ""
        l = 140737488349486
        slapd_pid_file_unlink = 0
        slapd_args_file_unlink = 0
        firstopt = 1
        __PRETTY_FUNCTION__ = "main"